PaperlayerView exact revision on arXiv

Source-linked AI summary

G-IDS: Generative Adversarial Networks Assisted Intrusion Detection System

Md Hasan Shahriar, Nur Imtiazul Haque, Mohammad Ashiqur Rahman, Miguel Alonso Jr

arXiv:2006.00676v1cs.CRcs.LG

TL;DR

Emerging CPS settings can have limited, imbalanced, or missing data, complicating IDS training. G-IDS augments training with GAN-generated samples. The authors report higher macro F1 and more stable training than standalone IDS in their evaluation.

Abstract

from arXiv · show

The boundaries of cyber-physical systems (CPS) and the Internet of Things (IoT) are converging together day by day to introduce a common platform on hybrid systems. Moreover, the combination of artificial intelligence (AI) with CPS creates a new dimension of technological advancement. All these connectivity and dependability are creating massive space for the attackers to launch cyber attacks. To defend against these attacks, intrusion detection system (IDS) has been widely used. However, emerging CPS technologies suffer from imbalanced and missing sample data, which makes the training of IDS difficult. In this paper, we propose a generative adversarial network (GAN) based intrusion detection system (G-IDS), where GAN generates synthetic samples, and IDS gets trained on them along with the original ones. G-IDS also fixes the difficulties of imbalanced or missing data problems. We model a network security dataset for an emerging CPS using NSL KDD-99 dataset and evaluate our proposed model's performance using different metrics. We find that our proposed G-IDS model performs much better in attack detection and model stabilization during the training process than a standalone IDS.

I. INTRODUCTION

CPS and IoT connectivity expands the attack surface, while emerging systems often lack sufficient, balanced training data for IDS models. The paper proposes G-IDS, which uses GAN-generated samples to augment training, and evaluates it against a standalone IDS on KDD’99.

I. INTRODUCTION

  • CPS applications rely on networked data transfer between sensors and actuators, creating opportunities for adversaries to attack open networks.The paper lists domains including transportation, production, smart grids, and healthcare.Source: §I · p. 1
  • The introduction presents IDS as a defense component that inspects network and system data for malicious activity and issues alerts.The paper describes intrusion prevention systems as working alongside IDS to prevent harm.Source: §I · p. 1
  • Emerging CPS technologies can lack sufficient training data, and available data may contain too few samples for some attack classes compared with normal traffic.The paper identifies these data limitations as obstacles to training IDS models.Source: §I · p. 1
  • The authors list an ANN-based IDS model trained on databases and an emerging-CPS security dataset where standalone IDS prediction is inadequate.These are stated contributions alongside the proposed G-IDS framework.Source: §I · p. 1
  • G-IDS uses GAN-generated training data to address imbalanced and missing samples, and the paper reports that it outperforms standalone IDS in multiple ways.The evaluation uses the KDD’99 network intrusion detection dataset.Source: §I · p. 1

II. BACKGROUND AND MOTIVATION

  • The paper frames CPS as systems combining computational and physical capabilities that interact with people through new modalities.It situates this background alongside the security motivation for CPS and IDS.Source: §II · p. 2

A. Security Challenges in CPS

CPS combine computation, networking, and physical processes, while their varied and evolving settings present security challenges. The section also reviews IDS approaches and GANs as background for the paper’s framework.

A. Security Challenges in CPS

  • CPS vulnerabilities are associated with software-based controllers, open-network connectivity, public system designs, expanding functionality, and increasingly skilled cyber-criminals.The paper also notes that CPS domains differ and may lack related data and experimentation.Source: A. Security Challenges in CPS · p. 2

B. Intrusion Detection Systems in CPS

  • Anomaly-based IDS learns training-data distributions and needs more data for each label to update detection as new attacks appear.The paper also describes data-mining, machine-learning, rule-based, statistical, protocol, and signal-processing approaches to CPS IDS.Source: B. Intrusion Detection Systems in CPS · p. 2

C. Generative Adversarial Networks (GAN)

  • GANs use a generator to produce samples from input noise and a discriminator to judge whether samples come from real data.The generator and discriminator optimize opposing objectives in a minmax game, seeking a Nash equilibrium.Source: C. Generative Adversarial Networks (GAN) · pp. 2–3

D. Research Motivation

Emerging CPS domains face distinct attack patterns but often lack sufficient, balanced data for IDS training, while GAN applications in CPS security have not addressed this data gap. G-IDS synthesizes training samples for weakly detected classes and evaluates pending samples before retaining them.

D. Research Motivation

  • Emerging CPS domains have distinct attack patterns and often lack databases or sufficient attack samples to train IDS effectively.The motivation also notes that novel zero-day attacks occur as attackers regularly launch new kinds of cyberattacks.Source: D. Research Motivation · p. 3
  • Imbalanced normal and attack data, missing data, and insufficient samples complicate IDS training; GANs can learn data distributions and generate similar samples.The paper argues that sufficient data is needed for high-accuracy IDS training.Source: D. Research Motivation · p. 3

III. RELATED WORK

  • Prior GAN-based CPS security work did not address imbalanced and limited data for emerging CPS, the gap G-IDS targets.The paper describes G-IDS as synthesizing training data and reports evaluating it with an ANN-based IDS on a network intrusion dataset.Source: §III · p. 3

IV. PROPOSED G-IDS FRAMEWORK

  • G-IDS stores original, pending, and verified synthetic samples separately, using GAN-generated data for weak classes and controller evaluations to accept or reject pending samples.The process repeats until the controller finds label-wise IDS performance satisfactory.Source: §IV · pp. 3–4

V. G-IDS TECHNICAL DETAILS

The technical workflow collects and preprocesses network packets, stores labeled data with source and review flags, and uses an iterative GAN-and-IDS process to assess generated samples before retaining them.

1) Data Collector (DC):

  • The data collector captures network packets, works with a firewall to label them, and preprocesses them for machine-learning models.The described preprocessing includes label encoding, standard scaling, and feature extraction.Source: 1) Data Collector (DC) · p. 4

2) Database (DB):

  • The database stores collected data with labels identifying normal or attack samples and flags recording each sample's status.Data collected by the collector are flagged as original.Source: 2) Database (DB) · p. 4
  • For a weak label, the algorithm samples noise and HybridDatabase examples, updates the discriminator and generator, then generates samples for that label.It creates a temporary binary-label copy of the HybridDatabase for each weak label.Source: 2) Database (DB) · p. 5
  • Generated samples enter the database as pending, and the IDS is trained with them to assess their contribution before the controller accepts or removes them.Pending samples that improve IDS performance are marked synthetic and retained; those that degrade performance are removed.Source: 2) Database (DB) · p. 5

B. Intrusion Detection System Module (IDSM)

The intrusion-detection module uses a multilayer ANN and compares label-wise performance on the hybrid database with performance after adding pending samples.

B. Intrusion Detection System Module (IDSM)

C. Controller Module (CM)

The controller identifies classes below a performance threshold for synthesis and evaluates whether pending samples improve IDS performance before updating the database.

C. Controller Module (CM)

D. Data Synthesizer Module (DSM)

The DSM uses a GAN to generate additional samples for selected classes, while the dataset description establishes the multiclass and sparsity context for evaluation.

D. Data Synthesizer Module (DSM)

  • The controller labels a selected class 1 and all others 0, making the DSM binary; its four-layer generator and discriminator each use 50-node hidden layers and generate new samples after successful training.The generator takes 5 noise inputs and outputs 20-feature samples; the discriminator maps 20 inputs to 1 output. After GAN training, new samples are added to the database with pending flags.Source: D. Data Synthesizer Module (DSM) · p. 6

VI. EVALUATION METHODOLOGY

  • The evaluation methodology introduces the setup and metrics used to assess G-IDS.Source: §VI · p. 6

A. Dataset

  • The study modifies KDD’99 to represent an empirical data-limitation scenario for evaluating attack detection.Source: A. Dataset · p. 6

1) Multiclass:

  • The modified KDD’99 dataset contains nine attack types across four attack classes and one normal label.The dataset passage also describes ten labels and names DoS, UTR, R2L, and probing among its categories.Source: 1) Multiclass · p. 6, A. Dataset · p. 6

2) Sparse:

  • The dataset is described as cleaned, with no missing attributes or records, although its calculated sparsity is 70% due to one-hot encoded features.The passage defines sparsity in terms of missing values and attributes the reported sparsity to encoding.Source: 2) Sparse · p. 6

3) Imbalanced:

The section describes class imbalance and preprocessing choices, including label encoding, standard scaling, and PCA-based feature reduction.

3) Imbalanced:

  • Benign examples dominate attack examples in the dataset, making it an example of class-imbalanced data.Source: 3) Imbalanced · p. 6

1) Encoding:

  • Label encoding is applied to the protocol type, service, and flag inputs and to the output feature.Source: 1) Encoding · p. 6

2) Feature Scaling:

  • Standard scaling replaces feature values with Z-scores to address local optima and feature skewness and to facilitate faster IDS training.The Z-score uses each feature’s mean and standard deviation.Source: 2) Feature Scaling · p. 7

3) Feature Extraction:

  • PCA reduces the 42 original features to 20 components while retaining 91.14% of total explained variance.The explained variance ratio is used to choose the number of components.Source: 3) Feature Extraction · p. 7

C. Data Modeling

The paper describes a stratified training-data selection and evaluates IDS predictions with classification metrics and a confusion matrix, emphasizing macro-average F1 for the imbalanced dataset.

C. Data Modeling

  • The study uses 5,000 samples for training and randomly selects from all available classes so the imbalanced split does not lose labels.The remaining data are used for testing.Source: C. Data Modeling · p. 7

D. Evaluation

1) Precision:

  • Precision is defined as correctly predicted positive observations divided by total positive observations.Source: 1) Precision · p. 7

2) Recall:

  • Recall is defined as correctly predicted positive observations divided by total actual positive observations.Source: 2) Recall · p. 7

3) F1 score:

  • F1 score combines precision and recall and accounts for both false positives and false negatives.The paper says F1 can better characterize performance when false-negative and false-positive counts are unequally distributed.Source: 3) F1 score · p. 7

4) Confusion Matrix:

  • A confusion matrix presents each class’s counts of correct and incorrect predictions, including true and false positives and negatives.Because benign data dominate, the evaluation uses macro-average F1, computing F1 independently for each label and averaging them equally.Source: 4) Confusion Matrix · p. 7, Table IV · p. 7

VII. EVALUATION RESULTS AND DISCUSSION

The experiments compare G-IDS with standalone IDS across training-set sizes and report stronger overall and label-wise F1 results for G-IDS, with a noted GAN-related fluctuation.

A. Evaluation based on the Size of Training Dataset

2) Overall Evaluation:

  • At full training size, macro F1 reaches at least 0.91 for G-IDS versus 0.87 for S-IDS; G-IDS improves by approximately 4% as synthetic data are included.The comparison uses the same test data across training-set sizes.Source: Figure 3 · p. 8, 2) Overall Evaluation · p. 8

1) Label-wise Evaluation:

  • For label 5, G-IDS reaches F1 0.90 with 20% training data and 0.96 with 40%, versus approximately 0.70 for S-IDS at 20% and 0.78 as its training data increases.The paper also reports similar improvements for labels 6 and 9, while noting a G-IDS F1-score fall at 60% that it attributes to GAN randomness.Source: 1) Label-wise Evaluation · p. 7, Figure 3 · p. 8

2) Overall Evaluation:

  • With 40% of original data, the controller sends labels below the 0.98 F1 threshold to the DSM; after 25% new samples are generated per weak label, labels 2, 5, 6, and 9 reach F1 scores of 0.93, 0.96, 0.68, and 0.41.The controller rejects generated data that it identifies as noisy and keeps the performance of G-IDS improving.Source: 2) Overall Evaluation · p. 8

B. Evaluation of Improvement in the Training Stability

G-IDS reaches training stability sooner than S-IDS, and the conclusion reports better accuracy even when training begins with a small original dataset. The framework’s centralized, computationally expensive, time-consuming nature remains under investigation.

B. Evaluation of Improvement in the Training Stability

VIII. CONCLUSION AND FUTURE WORK

  • G-IDS predicts with better accuracy than independent IDS even after training begins with a small original dataset.The authors identify the centralized, computationally expensive, and time-consuming nature of G-IDS as requiring further investigation.Source: §VIII · p. 10
  • The authors identify G-IDS’s centralized, computationally expensive, time-consuming design as requiring further investigation; future work targets a lightweight decentralized IoT-edge algorithm.Source: §VIII · p. 10
Loading 2006.00676v1…